1. Field of the Invention
The present invention relates generally to computer security, and more particularly but not exclusively to methods and systems for detecting phishing.
2. Description of the Background Art
Various online services are available over the Internet. Examples of these online services include online banking, data storage, webmail, social networks, etc. Generally speaking, an online service may be accessed with appropriate credentials, such as a user identifier (e.g., username, email address, mobile phone number) and a password. An end user may obtain credentials upon creation of an online account with the online service. The online service may maintain a website that serves a webpage for entering credentials, which is referred to as a “login page.”
The convenience provided by online services not only attracts legitimate end users but fraudsters as well. Fraudsters may gain access to an online account of a victim using a variety of techniques including by phishing. Phishing is a cyber attack that involves some form of misrepresentation. A fraudster may operate a malicious website or hijack a legitimate website to serve a phishing login page, which is a webpage that mimics the look and feel of a legitimate login page for the purpose of stealing the victim's credentials. The fraudster may direct the victim to the phishing login page by spam email, man-in-the-middle attack, etc. The phishing login page is made to look convincingly real to trick the victim into entering his credentials.
To combat phishing, the characteristics of phishing login pages (e.g., uniform resource locator (URL)) may be compiled in a blacklist. The blacklist may be consulted to determine if a particular login page is phishing, i.e., perpetrating or part of a phishing attack. However, because of the number of phishing login pages continually increase, it is relatively difficult to create and maintain such a blacklist.